Privacy policy

This policy explains how Øndig Jewellery ApS handles your personal data. It applies when you visit oendig.com, design a piece in our editor, order from us or sign up for our newsletter. It follows the EU General Data Protection Regulation (GDPR).

Last updated: 28 October 2026

Who is responsible

Øndig Jewellery ApS is the controller for your personal data. You can contact us here:

  • Øndig Jewellery ApS
  • Hyldevang 2, 7323 Give, Denmark
  • CVR (Danish business register) no. 43282980
  • Email: hej@oendig.dk

Our website is oendig.com. The checkout and order handling run on our shop system at oendig.dk. This policy also covers that system.

What we collect and why

You can visit our website without telling us who you are. We need some personal data to sell to you and to deliver your order. We collect only the data we need. We do not collect personal data about you from third parties.

Visiting our website or placing an order does not mean that you consent to cookies, marketing or the newsletter. You give consent separately, and you can withdraw it at any time.

Orders and delivery

To deliver your order we need your name, address, phone number and email address. We also keep the details of your order. Without this data we cannot take or deliver your order.

We use this data to take your order, engrave and send your piece, handle payment and answer questions about delivery. The legal basis is article 6(1)(b) GDPR: it is necessary for the contract with you.

We must keep bookkeeping records of your purchase. The legal basis for this is article 6(1)(c) GDPR: a legal obligation.

You pay with the payment methods shown at checkout. Our payment service providers handle your payment details. We never see or store full card numbers, bank account numbers or similar.

Your design and saved design drafts

In the editor we process your design: the motif, drawing, photo, fingerprint or text you choose or upload. We use it to prepare and engrave your piece. The legal basis is article 6(1)(b) GDPR.

If you save a free design draft, we ask for your email address so that we can send you the link to your draft. The legal basis is article 6(1)(b) GDPR: a step you ask for before you order.

After an order we keep your design, the images you sent, the text of your engraving and our correspondence with you for up to 20 years after your last contact with us. Then we can make your piece again exactly like the first, if it is lost one day. The legal basis is article 6(1)(f) GDPR, our legitimate interest. You can object, see ‘Your rights’.

Customer service

If you write to us by email, on Instagram or Messenger, we use your contact details and your message to answer you. The legal basis is article 6(1)(b) GDPR when your question concerns an order or a purchase. Otherwise it is article 6(1)(f) GDPR, our legitimate interest in answering you.

Newsletter and monthly draw

If you want our newsletter, we use your email address to send it. The legal basis is your consent, article 6(1)(a) GDPR. As a subscriber, you also take part in our monthly draw for a necklace.

You may have given your consent when you ordered from us, when you signed up for our newsletter, or on one of our sign-up pages for the draw. When you sign up, we send you an email with a link. You are only signed up when you have confirmed with the link. If you send us your email address on Instagram or Messenger, you get the same email, and you are only signed up when you have confirmed.

When you sign up, we store your email address, the time you said yes and the wording you agreed to. We also store which link you came from, for example a link in a social media post. If you wrote to us on Instagram or Messenger, we also store a reference to the conversation and the message from us that you replied to.

You can unsubscribe at any time with one click on the link at the bottom of every email. You will then no longer receive the newsletter or take part in future draws.

We keep a record that you unsubscribed, so that we do not write to you again. We only write again if you sign up again and confirm with the link in our email. The legal basis for the record is article 6(1)(f) GDPR, our legitimate interest.

If our emails cannot be delivered, or if you mark an email from us as spam, we do not write to that address again.

The monthly draw

Each month we hold a draw for one necklace among newsletter subscribers who live in Denmark, and one among subscribers in all the other countries we deliver to. When a country has more than 100 subscribers, it may get its own draw. We use the country you give us when you sign up to put you in the right draw. In the Danish draw, you get one extra entry if you reply to that month’s email.

We keep a log of each draw: which email addresses took part, who replied to the month’s email and got an extra entry, and who was drawn. We keep the log for 5 years, so that we can show that the draw was done correctly. The legal basis is article 6(1)(f) GDPR, our legitimate interest.

If you win, we use the address and the motif you send us to make and send your necklace, as with any order.

We name a winner in public only if the winner has agreed, and then only by first name. The legal basis is the winner’s consent, article 6(1)(a) GDPR.

We send the newsletter and the draw emails through Resend. Resend is our processor. It processes your email address on our behalf and only on our instructions.

Cookies and similar technologies

With your consent we use cookies and similar technologies for statistics and marketing, and to remember your choices. Without your consent we use only the necessary ones. The legal basis is your consent, article 6(1)(a) GDPR. For the necessary ones it is article 6(1)(f) GDPR, our legitimate interest in running the shop.

Read more in our cookie policy.

If you agree to statistics, we use Microsoft Clarity to see how our website and editor are used, for example where visitors click and scroll. What you type into fields is hidden. If you agree to marketing, we use Hotjar (Hotjar Ltd.) for the same purpose. We use this to make the site easier to use.

You can withdraw your consent at any time by writing to hej@oendig.dk.

Who receives your data

Inside Øndig, only people who need the data for their work have access: those who run the online shop, those who engrave and pack orders, and customer service.

These are the recipients outside Øndig, by category:

  • Emails: Resend sends our emails, the newsletter and the monthly draw emails.
  • Messages: Meta (Instagram and Messenger), when you write to us there.
  • Payment: our payment service providers Frisbii (payment gateway) and Flatpay (card acquirer). We never see or store full card numbers.
  • Delivery: the carrier that delivers your parcel (PostNord or GLS) and Shipmondo (our shipping software) receive your name, address, phone number and email address to deliver the parcel.
  • Hosting and security: our web hosting providers, including Cloudflare, which serves oendig.com.
  • Statistics, only with your consent: Google (Google Analytics) and Microsoft (Microsoft Clarity).
  • Marketing, only with your consent: Meta (Meta Pixel and Meta Conversions API), TikTok (TikTok Pixel), Pinterest (Pinterest Tag), Google (Google Ads), Adservice, Partner-ads and Adtraction (affiliate networks) and Hotjar Ltd. (usage recordings).

For Meta we send some events from your browser and others from our own server (Meta Conversions API). When you buy something, we also send your contact details, such as your email address and phone number, to Meta in hashed form: converted into a code that cannot be read directly. This lets Meta see whether an ad led to the purchase. Partner-ads and Adtraction are affiliate networks. If you come to us through a link from one of their partners, the network is told about any purchase (order number, amount and any discount code), so that the partner can be paid a commission. We do all this only with your marketing consent. For the Meta Pixel, Meta and we are joint controllers for collecting and sending the data.

Transfers outside the EEA

Some of these providers are outside the EEA, for example in the USA. For these transfers we rely on the EU–US Data Privacy Framework or on the European Commission’s standard contractual clauses.

How long we keep data

  • Bookkeeping records of your purchase: 5 years, as the law requires.
  • Your design, the images you sent, your engraving text and our correspondence with you: up to 20 years after your last contact with us.
  • The log of a draw: 5 years.
  • Your newsletter sign-up: as long as you are subscribed.
  • The record that you unsubscribed: we keep it so that we do not write to you again.

If you want your data deleted, write to hej@oendig.dk. We delete it within 30 days and confirm when it is done. Bookkeeping data stays until the 5 years have passed. The log of a draw you took part in also stays until the 5 years have passed.

Your rights

You have the right to:

  • access the data we hold about you
  • have incorrect data corrected
  • have your data erased
  • restrict our processing of your data
  • receive your data in a portable format (data portability)
  • object to processing that is based on our legitimate interest
  • withdraw your consent at any time, without affecting the processing done before you withdrew

To use your rights, write to hej@oendig.dk.

Complaints

You can complain to Datatilsynet, the Danish Data Protection Agency: www.datatilsynet.dk. You can also complain to the data protection authority in your own EU country.

Automated decisions

We do not make decisions about you by automated means alone, and we do not do profiling that has legal effects on you.